ramdaspr,
Thanks You for your input.
The issue is that the default value token is not being passed to the search. Changing it to your latest modification of search it the passed value as token is still empty. I am looking for what needs to be changed in the dashboard so that the time input token is passed initially. After that time token is passed with tyhe value it is being passed which is working fine. How to pass the default token value for earliest tiime to search when the dashbard first loads.
Modified search in the dashboard:
[ | gentimes start=-1 index=xxxx| head 1
| eval earliest=relative_time(now(), "$time_input_tok.earliest$")
| eval latest=earliest+259200 |table earliest,latest
| format "(" "(" "" ")" "OR" ")" ]
index=xxxx sourcetype=aaaa
| fields TA, TM
| timechart span="5min" max(TM), avg(TA)
Here it how how the new search is being translated. Note the empty string passed in time token
[ | gentimes start=-1 index=xxxx| head 1
| eval earliest=relative_time(now(), *"")**
| eval latest=earliest+259200 |table earliest,latest
| format "(" "(" "" ")" "OR" ")" ]
index=xxxx sourcetype=aaaa
| fields TA, TM
| timechart span="5min" max(TM), avg(TA*)
... View more